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Remarks/Arpuments 

STATUS OF CLAIMS 

Claims 1 and 28 have been amended, and unelected claims 29-39, 71-97, and 100-120 
have been canceled, such that claims l-28 f 40-70. and 98-99 are currently pending in the 
application. Note: In a previous response, dated July 12, 2005, the Applicant elected to pursue 
claims 1-28, 40-70, and 98-99 in response to a restriction requirement; the unelected claims were 
inadvertently not expressly canceled at that time, 

REMARKS/ARGUMENTS 
In the Office Action date October 6, 2005, the Examiner: 

rejected claims 1-2, 5-8, 10-28, 40-52, 54-57, 63-66, and 98-99 under 35 U.S.C. §l02(b) 
as being anticipated by U.S. Patent No. 5,495,533 (hereinafter referred to as "linehan"); 

rejected claims 3-4, 53-54, 58-59, 67-69, 71-72, and 74-79 under 35 U.S.C* § 103(a) as 
being unpatentable overlinehan in view of U.S. Patent No. 5,764,772 ("Kaufman"); and 

rejected claims 60-62 and 71-72 under 35 U.S.C. §l03(a) as being upatentable over 
Linehan in view of Kaufman and further in view of U.S. Patent No. 6,199,1 13 ("Alegre"). 

1. Insufficiency of at Least Some Rejections. 
37 CFR §1.1 04(c)(2) states: 

In rejecting claims for want of novelty or for obviousness, the examiner must cite 
the best references at his or her command. When the reference is complex or 
shows or describes inventions other than that claimed by the applicant, the 
particular part relied on must be designated as nearly as practicable. The 
pertinence of each reference, if not apparent, must be clearly explained and each 
rejected claim specified. 

In that regard, MPEP §706 further states that "[t)he goal of examination is to clearly 
articulate any rejection early in the prosecution process so that the applicant has the opportunity 
to provide evidence of patentability and otherwise reply completely at the earliest opportunity". 
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In the present application, the Examiner appears in several instances to have rejected 
claims without any consideration for the particular limitations present in those claims, or, at 
least, no indication of any such consideration is present in the Office Action. More specifically, 
in several instances the Examiner has grouped a number of claims and then rejected the group 
based upon an assertion that is relevant to less than all of the claims of the group. Examples of 
these claims, the rejections of which are wholly unsupported, as discussed below, include 2, 6, 8, 
10, 11, 15, 17, 18, 23, 27, 42, 43, 44, 46, 48, 50, and 66. 

The Applicant respectfully requests that the Examiner either provide specific grounds for 
rejecting each limitation in each claim or allow those claims for which no such specific grounds 
exist It is the Examiner's initial burden to show that the claims are unpatentable (which is not 
met by mere unsupported rejections); absent such a showing, the Applicant has no burden to 
show thai the claims are patentable. 

To be clear: The Applicant is not arguing that the Examiner's rejections are 
unconvincingly supported, or that the Examiner cannot reject claims as a group; instead, the 
Applicant is asserting that the Examiner has provided no support whatsoever for the rejections of 
at least the listed claims, and that the Examiner cannot reject claims as group when the asserted 
support for the rejection of the group is not relevant to, or does not address, all of the claims 
included in the group. 

2. Staze of the Law with Respect to 35 U.S.C. $102(bL 

35 U.S.C. § 102(b) states, in relevant pan, that "[a] person shall be entitled to a patent 
unless the invention was patented or described in a printed publication in this or a foreign 
country or in public use or on sale in this country, more than one year prior to the date of 
application for patent in the United States." For rejections based on anticipation, there is no 
question of obviousness or modification of the reference, rather a single reference must teach 
each, every, and all aspects of the claimed invention either explicitly or impliedly, and any 
feature not directly taught must be inherently present. MPEP §§706.02 and 2131 citing 
Verdegaal Bros. v. Union Oil Co. Of California, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). 'The 
identical invention must be shown in as complete detail as is contained in the. ..claim." MPEP 
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§§706.02 and 2131 citing Richardson v. Suzuki Motor Co., 9 USPQ2d 1913, 1920 (Fed, Cir. 
1989). Furthermore, a prior art device can perform all of the functions of a claimed apparatus 
and yet not anticipate the claimed apparatus if the claimed apparatus and the prior art device are 
structurally distinguishable. MPEP §2114 citing In re Robertson, 49 USPQ2d 1949, 1951 (Fed. 
Cir. 1999). Thus, a rejection under 35 U.S.C. §102(b) is overcome by amending the claims to 
patentably distinguish over the prior art and/or persuasively arguing that the claims are 
patentably distinguishable from the cited prior art reference. MPEP §706.02(b). 

3. Linehan does not disclose each, every, and all a spects of the claimed invention. 

Unehan does not disclose each, every, and all aspects of the claimed invention, and 
therefore does not anticipate claims 1-2, 5-8, 10-28, 40-52, 54-57, 63-66, and 98-99 under 35 
USC § 102(b). 

With regard to claims I. 6-8, 10, 17-21, 26-28, 40-44, and 98-99, the Examiner has 
specifically cited col. 4, lines 1-26, and coL 7, lines 30-67, for support for his rejections. Lines 
1-18 of col. 4 concern reference citations which do not, on their face, appear relevant to the 
rejections. Lines 19-26 concern several objects, or purposes, of Linehan's invention, 
specifically: (1) "to provide an improved computing system", and (2) "to provide an improved 
computing system having improved security". Line 26 falls within the statement of a third 
object: (3) "to provide an improved computing system having improved security in a distributed 
computing environment". Clearly, these are exceedingly general statements having very little 
relevance to the patentability of any of the claims of the present application, and therefore 
piwide no support for the rejections. 

Lines 30-67 of coL 7 concern Linehan's basic method: 

[E]ach data file is encrypted by the Personal Key Client, on the user's computer, 
using a randomly-chosen key generated by the Personal Key Server at the time 
the file is created. The key is stored in the Personal Key Database located on the 
Personal Key Server. . . 

The Personal Key Server Database contains an entry for each file that is 
encrypted, these files are indexed by information that identifies the files... Each 
entry contains the key used to encrypt the corresponding file. . . 

WA 848487-1 
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When a file is created... the Personal Key Server randomly generates a file 
encryption key, creates a new entry in the database, and responds to the Personal 
Key Client with the file encryption key. The Personal Key Client then uses the 
key to encrypt the data as it is written to the file. 

When a file is accessed., .the [Personal Key Server] retrieves the appropriate entry 
in the database and checks the identity of the accessor... against the file owner's 
name and the access control list in the database entry. If the accessor is either the 
owner or one of the users named in the access control list, the Server sends the 
file encryption key back to the Personal Key Client. The latter uses the key to 
decrypt the data as it is read from the file. 

Though the Examiner has pointed generally to the foregoing as support for his rejections, 
he has failed to identify a specific structure or step that corresponds to each and every claim 
limitation. In fact, the disclosure contradicts the Examiner's assertions. In linehan, the file is 
encrypted and stored on the user's computer while the encryption key is generated and stored on 
the Personal Key Server. More specifically, the Personal Key Server Database contains an 
encrypted entry for each encrypted file, and the entry contains the key used to encrypt the 
encrypted file. On the Personal Key Database, the entry is indexed by information thai identifies 
the file - not the key. And so, when it is desired to access the encrypted file stored on the user's 
computer, the Personal Key Client queries the Personal Key Server with information identifying 
the file, the Personal Key Server retrieves the key based upon the information and provides it to 
the Personal Key Client, and the Personal Key client decrypts the file. 

This distinction is important: Linehan uses some aspect or property of the encrypted data 
file, such as the names, creation dates, or hash values, as a pointer to the encryption key. This is 
problematic because these aspects or properties are either subject to change or are insufficient by 
themselves to provide distinct identification. By contrast, the present invention uses a randomly- 
generated encryption key identification which both does not change and is sufficient to provide 
distinct identification. 

If the Examiner persists in asserting that Linehan discloses the claimed encryption key 
identification, the Applicant respectfully requests that the Examiner specifically identify the 
structure or step which he believes corresponds thereto so that the Applicant can, in turn, 
specifically refute the correspondence. 
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Thus, Linehan does not disclose a data structure comprising an encrypted data entity 
having a searchable attribute and an encryption key identification corresponding to the 
encryption key, as required by the rejected claims. 

Furthermore, with regard specifically to claims 6 and 8> the Examiner has failed to 
identify in Linehan, or even co assert that Linehan discloses, the limitations involving dynamic 
encryption. With regard specifically to claim 10, the Examiner has failed to identify in Linehan, 
or even to assert that Linehan discloses, the limitation involving an integrity attribute. With 
regard specifically to claim 17, the Examiner has failed to identify in Linehan, or even to assert 
that Linehan discloses, che limitation involving a plurality of attributes. With regard specifically 
to claim 18, the Examiner has failed to identify in Linehan, or even to assert that Linehan 
discloses, the limitation involving a second data entity including as attributes the encryption key 
and the encryption key identification. With regard specifically to claim 27, the Examiner has 
failed to identify in Linehan, or even to assert that linehan discloses, the limitation involving the 
first data entity containing medical patient name information, and the second data entity 
containing medical patient address information. With regard specifically to claims 42 and 43, 
the Examiner has failed to identify in Linehan, or even to assert that Linehan discloses, the 
limitations involving the request for the data manipulation comprising, respectively, a data, 
update or an addition of new information, and further comprising encrypting the new information 
with a second encryption key. With regard specifically to claim 44, the Examiner has failed to 
identify in Linehan, or even to assert that Linehan discloses, the limitations involving the request 
for the data manipulation comprising a request to view current information, and further 
comprising encrypting the viewed information with a second encryption key. The Examiner has 
clearly failed to provide any discussion or support whatsoever for his rejections of these claims, 
and appears to not have considered them at all. 

The Examiner has also dismissed claims 2, 5, 11, 13-16, 22-25, 45-50, and 66 with the 
simple assertion that "Linehan discloses wherein the at least one encryption key identification is 
encrypted by a system key". In fact, Linehan discloses only a control key which is used to 
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encrypt the encryption key (see col. 9, lines 10-18); Linehan does not disclose either an 
encryption key identification or a system key for encrypting the encryption key identification. 

Furthermore, with regard specifically to claim 2, the Examiner has failed to identify in 
Linehan, or even to assert that Linehan discloses, the limitation involving the system key 
common name being stored in association with the data entity. With regard specifically to claim 
11. the Examiner has failed to identify in Linehan, or even to assert that Linehan discloses, the 
limitation involving the data structure further comprising a system key attribute of the data 
entity, the security key attribute including the at least one encryption key identification and 
system key common name. With regard specifically to claims 14 and 46, the Examiner has 
failed 10 Identify in Linclitiii, in even to assert that Linehan ditcloeee, the limitation involving 
storing the system key on a security token. With regard specifically to claim 15, the Examiner 
has failed to identify in Linehan, or even to assert that Linehan discloses, the limitation involving 
the security token comprising a smart card. With regard specifically to claims 23 and 48, the 
Examiner has failed to identify in Linehan, or even to assert that Linehan discloses, the limitation 
involving the system key comprising a public system key. With regard specifically to claim 50, 
the Examiner has failed to identify in Linehan, or even to assert that Linehan discloses, the 
limitation involving storing the system key common name in association with the data entity. 
With regard specifically to claim 66, the Examiner has failed to identify in Linehan, or even to 
assert that Linehan discloses, the limitation involving encrypting the encryption key 
identification with a system key having a system key common name, and maintaining the system 
key within a security domain at all times. The Examiner has clearly failed to provide any 
discussion or support whatsoever for his rejections of these claims, and appears to not have 
considered them at all. 

The Examiner has also rejected claims 12, 51-52, 55-57, 63-65, 70, and 73, relying on the 
assertion that Linehan discloses an encryption key identification. As discussed, however, it does 
not. 

Thus, Linehan does not disclose each, every, and all aspects of the claimed invention, nor 
are the undisclosed aspects inherently present. For at least the reasons disciissRd_ahove, Linehan 
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does not anticipate claims 1-2, 5-8, 10-28, 40-52, 54-57, 63-^6, and 98-99, and therefore the 
Examiner's rejection of those claims are improper and have been overcome. 

4. State of the Law iw'rft Respect to 35 U.S.C. S103(al 
When rejecting claims under 35 U.S.C. §103, MPEP §2142 places upon the Examiner the 
initial burden of establishing a prima facie case of obviousness. If the Examiner fails to establish 
the requisite prima facie case, the rejection is improper and will be overturned. In re Rijckaert, 
28 USPQ2d 1955 (Fed. Cir. 1993). Only if the Examiner's burden is met does the burden shift 
to the applicant to provide evidence to refute the rejection. 

The Examiner must satisfy three criteria in order to establish the requisite prima facie 
case: (1) there must be some suggestion or motivation, either in the references themselves or in 
the knowledge generally available to one of ordinary skill in the art, to modify the reference or 
combine their teachings; (2) there must be a reasonable expectation of success; and (3) the prior 
art reference (or combination of references) must teach or suggest all the claim limitations. 
MPEP §706.02(j), citing In re Vaeck, 20 USPQ2d 1438 (Fed. Cir. 1991). Furthermore, "[t]he 
mere fact that the prior art may be modified in the manner suggested by the Examiner does not 
make the modification obvious unless the prior art suggested the desirability of the 
modification/ 1 In re Fritch, 23 USPQ2d 1780 (Fed. Cir. 1992); see also In re Gordon, 221 
USPQ2d 1125 (Fed. Cir. 1984). Additionally, ,6 if the proposed modification would render the 
prior art invention being modified unsatisfactory for its intended purpose, then there is no 
suggestion or motivation to make the proposed modification." MPEP §2143.01. 

In meeting this initial burden, the Examiner "cannot use hindsight reconstruction to pick 
and choose among isolated disclosures in the prior art to deprecate the claimed invention" In re 
Fine, 5 USPQ 2d 1596 (Fed. Or. 1988). The teaching or suggestion to make the claimed 
combination and the reasonable expectation of success must both be found in the prior art and 
not based on the applicant's disclosure. In re Vaeck, 1442. Thus, "[measuring a claimed 
invention against the standard established by section 103 requires the oft-difficult but critical 
step of casting the mind back to the time of invention, to consider the thinking of one of ordinary 
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skill in the art, guided only by the prior art references and the then-accepted wisdom in the 
field." W. L. Gore & Assoc, Inc. v. Garlock, Inc., 220 USPQ 303 (Fed. Cir. 1983). 

5. The Examiner has failed to establish the requisite pri ma facie case± 

The combination of linehan and Kaufman does not disclose each, every, and all aspects 
of the claimed invention, and does not suggest to or motivate one with ordinary skill to modify 
the references to arrive at the claimed invention, and therefore does not render obvious claims 3- 
4, 53-54, 58-59, 67-69, 71-72, and 74-79 under 35 U.S.C. §103(a). 

With regard specifically to claim 9, the Examiner has failed to identify in the references, 
or even to assert that the references disclose or suggest, the limitation involving the data structure 
comprising a plurality of hash values with each of the searchable attributes having a 
corresponding hash value. 

The Examiner has also rejected claims 54, 58-59, 67-69, 71-72, and 74-79, relying on the 
assertion that Linehan discloses an encryption key identification. As discussed, however, it does 
not. 

Similarly, the combination of Linehan, Kaufman, and Alegre does not disclose each, 
every, and all aspects of the claimed invention, and does not suggest to or motivate one with 
ordinary skill to modify the references as asserted, and therefore doe$ not render obvious claims 
60-62 and 71-72 under 35 U.S.C. § 103(a). 

With regard specifically to claim 60, the Examiner has failed to identify in the references, 
or even to assert that the references disclose or suggest, the limitation involving transmitting the 
data entity over a data transmission line, and wherein encrypting the data entity comprises 
encrypting only a portion of the data entity in accordance with a business rule. 

Thus, the combinations of references fail to teach or suggest all of the limitations of the 
claims. As the Examiner has failed to establish the requisite prima facie case of obviousness, the 
Applicant respectfully asserts that Examiner's rejections of claims 3-4, 53-54, 58-59, 60-62, 67- 
69, 71-72, and 74-79 under 35 U.S.C, § 103(a) are improper and have been overcome. 
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CONCLUSION 

The above Amendment is fully responsive to the office action dated October 6, 2005. 
The Application asserts that the claims are in condition for allowance, and respectfully requests a 
corresponding Notice of Allowance. If there are any matters which can be further clarified by 
telephone, the Examiner is requested to contact the undersigned attorney. 

The Office is authorized to charge any fees due or credit any overpayments in connection 
with the filing of this paper to Deposit Account No. 50-0354. 

SPENCER FANF. KR fTT A BROWNE LLP 



Gerhard P. Shipley, Reg. No. 45,682 
Spencer Fane Britt & Browne LLP 
1000 Walnut, Suite 1400 
Kansas City, MO 64106 
Tele: 816-474-8100 
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